Malicious Code Injection in accepted_marlin_0xrequest Package
Summary
MAL-2025-99076: Malicious code in accepted_marlin_0xrequest (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The accepted_marlin_0xrequest package is part of the npm ecosystem, primarily used for JavaScript applications. It is associated with the tea.xyz token reward campaign, which has been known to flood the npm registry with various packages. This package, like others in the campaign, is designed to manipulate npm's publishing system, potentially compromising the integrity of applications that depend on it.
Vulnerability Detail
The vulnerability in the accepted_marlin_0xrequest package stems from malicious code that modifies the package.json file. This code removes private flags, alters version numbers, and generates random package names to inflate developer reputation scores. The malicious payload continuously republishes these variants, polluting the npm registry and posing risks such as dependency confusion and potential exploitation of applications relying on these packages.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall accepted_marlin_0xrequestIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can prevent the installation of this package by using npm's package-lock.json to monitor dependencies. You can also use the following command to uninstall the package: npm uninstall accepted_marlin_0xrequest.
Conclusion
The accepted_marlin_0xrequest package contains a significant vulnerability due to malicious code that alters package metadata and republishing behavior. It is crucial to update or remove this package to protect your application from potential exploitation. Utilizing tools like Vulert can aid in monitoring and managing open-source vulnerabilities effectively.
See every vulnerability recorded for accepted_marlin_0xrequest →
FAQ
It is an npm package associated with the tea.xyz token reward campaign, which has been linked to malicious activities.
The vulnerability can lead to the injection of malicious code, altering your application's dependencies and potentially compromising its security.
Yes, you can use Vulert, which monitors open-source vulnerabilities in real-time. You can check your application using the Vulert playground at Vulert Scanner without any signup.
If no patched version is available, consider removing the package and replacing it with a secure alternative to mitigate risks.
Regularly monitor your dependencies using tools like Vulert and keep your packages updated to the latest secure versions.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
